Title: [259849] trunk/Source/_javascript_Core
- Revision
- 259849
- Author
- [email protected]
- Date
- 2020-04-09 23:48:09 -0700 (Thu, 09 Apr 2020)
Log Message
[JSC] Use UnconditionalWriteBarrier in Baseline effectively to reduce code size
https://bugs.webkit.org/show_bug.cgi?id=209395
Reviewed by Tadeu Zagallo.
In put/delete we always need to emit write-barrier if the base is a cell since IC can write things (writing new StructureID etc.).
We should use emitWriteBarrier with UnconditionalWriteBarrier to remove unnecessary branch.
* jit/JITPropertyAccess.cpp:
(JSC::JIT::emitPutByValWithCachedId):
(JSC::JIT::emit_op_del_by_id):
(JSC::JIT::emit_op_del_by_val):
(JSC::JIT::emit_op_put_by_id):
* jit/JITPropertyAccess32_64.cpp:
(JSC::JIT::emitPutByValWithCachedId):
(JSC::JIT::emit_op_put_by_id):
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (259848 => 259849)
--- trunk/Source/_javascript_Core/ChangeLog 2020-04-10 06:25:42 UTC (rev 259848)
+++ trunk/Source/_javascript_Core/ChangeLog 2020-04-10 06:48:09 UTC (rev 259849)
@@ -1,3 +1,22 @@
+2020-04-09 Yusuke Suzuki <[email protected]>
+
+ [JSC] Use UnconditionalWriteBarrier in Baseline effectively to reduce code size
+ https://bugs.webkit.org/show_bug.cgi?id=209395
+
+ Reviewed by Tadeu Zagallo.
+
+ In put/delete we always need to emit write-barrier if the base is a cell since IC can write things (writing new StructureID etc.).
+ We should use emitWriteBarrier with UnconditionalWriteBarrier to remove unnecessary branch.
+
+ * jit/JITPropertyAccess.cpp:
+ (JSC::JIT::emitPutByValWithCachedId):
+ (JSC::JIT::emit_op_del_by_id):
+ (JSC::JIT::emit_op_del_by_val):
+ (JSC::JIT::emit_op_put_by_id):
+ * jit/JITPropertyAccess32_64.cpp:
+ (JSC::JIT::emitPutByValWithCachedId):
+ (JSC::JIT::emit_op_put_by_id):
+
2020-04-09 Mark Lam <[email protected]>
Fix bad tests in testmasm's testCagePreservesPACFailureBit().
Modified: trunk/Source/_javascript_Core/jit/JITPropertyAccess.cpp (259848 => 259849)
--- trunk/Source/_javascript_Core/jit/JITPropertyAccess.cpp 2020-04-10 06:25:42 UTC (rev 259848)
+++ trunk/Source/_javascript_Core/jit/JITPropertyAccess.cpp 2020-04-10 06:48:09 UTC (rev 259849)
@@ -290,9 +290,8 @@
JSValueRegs(regT0), JSValueRegs(regT1), regT2, bytecode.m_ecmaMode, putKind);
gen.generateFastPath(*this);
// IC can write new Structure without write-barrier if a base is cell.
- // FIXME: Use UnconditionalWriteBarrier in Baseline effectively to reduce code size.
- // https://bugs.webkit.org/show_bug.cgi?id=209395
- emitWriteBarrier(base, ShouldFilterBase);
+ // We emit write-barrier unconditionally since we know baseVRege is a cell.
+ emitWriteBarrier(base, UnconditionalWriteBarrier);
doneCases.append(jump());
Label coldPathBegin = label();
@@ -409,10 +408,9 @@
emitPutVirtualRegister(dst, JSValueRegs(regT0));
// IC can write new Structure without write-barrier if a base is cell.
+ // We emit write-barrier unconditionally since we know baseVRege is a cell.
// We should emit write-barrier at the end of sequence since write-barrier clobbers registers.
- // FIXME: Use UnconditionalWriteBarrier in Baseline effectively to reduce code size.
- // https://bugs.webkit.org/show_bug.cgi?id=209395
- emitWriteBarrier(base, ShouldFilterBase);
+ emitWriteBarrier(base, UnconditionalWriteBarrier);
}
void JIT::emitSlow_op_del_by_id(const Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
@@ -459,9 +457,8 @@
// We should emit write-barrier at the end of sequence since write-barrier clobbers registers.
// IC can write new Structure without write-barrier if a base is cell.
- // FIXME: Use UnconditionalWriteBarrier in Baseline effectively to reduce code size.
- // https://bugs.webkit.org/show_bug.cgi?id=209395
- emitWriteBarrier(base, ShouldFilterBase);
+ // We emit write-barrier unconditionally since we know baseVRege is a cell.
+ emitWriteBarrier(base, UnconditionalWriteBarrier);
}
void JIT::emitSlow_op_del_by_val(const Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
@@ -678,9 +675,8 @@
m_putByIds.append(gen);
// IC can write new Structure without write-barrier if a base is cell.
- // FIXME: Use UnconditionalWriteBarrier in Baseline effectively to reduce code size.
- // https://bugs.webkit.org/show_bug.cgi?id=209395
- emitWriteBarrier(baseVReg, ShouldFilterBase);
+ // We emit write-barrier unconditionally since we know baseVRege is a cell.
+ emitWriteBarrier(baseVReg, UnconditionalWriteBarrier);
}
void JIT::emitSlow_op_put_by_id(const Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
Modified: trunk/Source/_javascript_Core/jit/JITPropertyAccess32_64.cpp (259848 => 259849)
--- trunk/Source/_javascript_Core/jit/JITPropertyAccess32_64.cpp 2020-04-10 06:25:42 UTC (rev 259848)
+++ trunk/Source/_javascript_Core/jit/JITPropertyAccess32_64.cpp 2020-04-10 06:48:09 UTC (rev 259849)
@@ -369,10 +369,9 @@
// reload the registers.
//
// IC can write new Structure without write-barrier if a base is cell.
+ // We emit write-barrier unconditionally since we know baseVRege is a cell.
// We are emitting write-barrier before writing here but this is OK since 32bit JSC does not have concurrent GC.
- // FIXME: Use UnconditionalWriteBarrier in Baseline effectively to reduce code size.
- // https://bugs.webkit.org/show_bug.cgi?id=209395
- emitWriteBarrier(base, ShouldFilterBase);
+ emitWriteBarrier(base, UnconditionalWriteBarrier);
emitLoadPayload(base, regT0);
emitLoad(value, regT3, regT2);
@@ -623,9 +622,8 @@
m_putByIds.append(gen);
// IC can write new Structure without write-barrier if a base is cell.
- // FIXME: Use UnconditionalWriteBarrier in Baseline effectively to reduce code size.
- // https://bugs.webkit.org/show_bug.cgi?id=209395
- emitWriteBarrier(base, ShouldFilterBase);
+ // We emit write-barrier unconditionally since we know baseVRege is a cell.
+ emitWriteBarrier(base, UnconditionalWriteBarrier);
}
void JIT::emitSlow_op_put_by_id(const Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
